Attack paths don’t appear by accident. Does this sound familiar?
"We'll fix it later"
"It hasn't cause any problems yet"
"Tom does it this way, but I prefer my way"
"We don't have time to fully implement that right now"
It all adds up quietly. Until one day, an attacker finds the needle in the hay stack.
That one permission, one group, one account, that one "little" mistake, that was not supposed to be there, but was.
It's not because IT admins, despite the stereotypes, are lazy. It's because of inconsistent operational discipline.
Inconsistent operational discipline has a compounding affect. That’s what really creates technical debt.
Much like financial debt, it's rare to pay off this debt in one fell swoop.
What you need is consistent operational discipline. A topic that's too out of scope for this conversation.
So instead, here's my recommended (& practical) recommendations for eliminating attack paths in Active Directory, in realistic time frames.
One Day
You're trying to prevent the "Domain Admin by Lunch" situations...
Remove non-essential users from tier-0 groups (Domain Admins, Enterprise Admins, etc.)
Disable unused accounts (especially service accounts)
Fix DCSync permissions on anything that isn’t true Tier-0
Rotate passwords for service accounts (make them as long as possible)
Check for insecure permissions on the root of the domain (and all other tier-0 users, computers, groups and OUs)
One Week
Focus on key attacker phases, like lateral movement and privilege escalation...
Deploy LAPS to all workstations & servers
Implement fine-grained password policies (why not, it's free)
Lock down GPO logon rights so Domain Admins can’t touch workstations
Clean up unconstrained delegation
Fix dangerous ACLs (Use ADeleginator and make sure to check Domain Users, Authenticated Users & Everyone)
Identify dangerous certificate templates & document a plan to address them (Fix ESC1, ESC4, ESC5 ASAP)
One Month
Now you're getting into reducing attack surface and "blast radius"...
Begin separating admin accounts (especially from daily use accounts)
Restrict PowerShell Remoting to/from admin subnets only
Review all Security Groups for unnecessary users (privilege creep)
Ensure the built-in Firewall is enabled on all workstations and servers
Document everything else you have found but can't fix yet
One Year
Now you're getting into reducing attack surface and "blast radius"...
Begin separating admin accounts (especially from daily use accounts)
Restrict PowerShell Remoting to/from admin subnets only
Review all Security Groups for unnecessary users (privilege creep)
Ensure the built-in Firewall is enabled on all workstations and servers
Document everything else you have found but can't fix yet
These are obviously not complete lists, but they sure are some heavy hitters.
Let's be honest for a minute, as you're going through this list, how many can you say you've done?
If you're in the "most of them" boat, then you're seriously doing an awesome job. Keep the progress going.
If you're not in that boat, why not? What do you think is holding you back?
Fear of breaking things?
Don't know how?
Lack of clarity?
No time?
No buy-in or support?
I know it's not because you don't care. You might be the only one who does.
I've pentested a lot of organizations.
I was a sysadmin for 10+ years before that.
I've seen a lot of issues, I've fixed a lot of issues.
It's almost never a technical problem.
It's a:
People problem
Process problem
Resource problem
Skill problem
Leadership problem
You don't have to know everything in IT and security. It's knowing what matters most, removing blockers and making progress anyways.
Save this list of recommendations. Come back to it after a day, a week, a month, a year and more....and see just how far you've come.
I'm rooting for you. You got this. 💪
All the best
Spencer
PS - If you want even more quick wins to secure Active Directory, check out this podcast I did back in 2023. Yes, it’s all still relevant today.